Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
rabbyhub/rabby
develop @ 05e4d1e
45
Fixes
0
CVEs
HIGH
Peak severity
38.5%
Coverage
Highlights
Auth Bypass: 25 prior fixes. Scrutinize any change in this area.
src/background/controller/provider/controller.ts: most-fixed (9 issues). Treat as high-risk during review.
24 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Typo-based permission checks, invalid parameter-to-address mappings during signature validation, and unvetted RPC methods decorated as 'SAFE' collectively allowed unauthorized actions from malicious sites.
Auth Bypass: Bypasses in transaction signing gates occurred due to incomplete rule-level override handling, relying on flawed preprocessing checks, or failure to disable signing actions on watch-only addresses.
Auth Bypass: EIP-712 typing fields were parsed and normalized insecurely, allowing crafted hex addresses and custom structures to bypass standard validation and security engine inspection checks.